cnvd - cnvd-2019-07368

cnvd-2019-07368

Vulnerability from cnvd

Title: 多款IBM产品任意文件下载漏洞

Description:

IBM SAN Volume Controller等都是IBM公司的产品。BM SAN Volume Controller (SVC) 可为存储系统简化存储基础设施的管理、分层存储和高级复制功能。

多款IBM产品中的Service Assistant存在安全漏洞。攻击者可利用该漏洞从操作系统中下载任意文件。

Severity: 中

Patch Name: 多款IBM产品任意文件下载漏洞的补丁

Patch Description:

IBM SAN Volume Controller等都是IBM公司的产品。BM SAN Volume Controller (SVC) 可为存储系统简化存储基础设施的管理、分层存储和高级复制功能。

多款IBM产品中的Service Assistant存在安全漏洞。攻击者可利用该漏洞从操作系统中下载任意文件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www-01.ibm.com/support/docview.wss?uid=ibm10872486

Reference: http://www.ibm.com/support/docview.wss https://www.securityfocus.com/bid/107187

Impacted products

Name
['IBM SAN Volume Controller', 'IBM Storwize V7000', 'IBM Storwize V5000', 'IBM FlashSystem V9000', 'IBM Storwize V3700', 'IBM Storwize V3500', 'IBM FlashSystem 9100 Family', 'IBM Spectrum Virtualize Software', 'IBM Spectrum Virtualize for Public Cloud']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-1775"
    }
  },
  "description": "IBM SAN Volume Controller\u7b49\u90fd\u662fIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002BM SAN Volume Controller (SVC) \u53ef\u4e3a\u5b58\u50a8\u7cfb\u7edf\u7b80\u5316\u5b58\u50a8\u57fa\u7840\u8bbe\u65bd\u7684\u7ba1\u7406\u3001\u5206\u5c42\u5b58\u50a8\u548c\u9ad8\u7ea7\u590d\u5236\u529f\u80fd\u3002\n\n\u591a\u6b3eIBM\u4ea7\u54c1\u4e2d\u7684Service Assistant\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ece\u64cd\u4f5c\u7cfb\u7edf\u4e2d\u4e0b\u8f7d\u4efb\u610f\u6587\u4ef6\u3002",
  "discovererName": "IBM",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www-01.ibm.com/support/docview.wss?uid=ibm10872486",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-07368",
  "openTime": "2019-03-17",
  "patchDescription": "IBM SAN Volume Controller\u7b49\u90fd\u662fIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002BM SAN Volume Controller (SVC) \u53ef\u4e3a\u5b58\u50a8\u7cfb\u7edf\u7b80\u5316\u5b58\u50a8\u57fa\u7840\u8bbe\u65bd\u7684\u7ba1\u7406\u3001\u5206\u5c42\u5b58\u50a8\u548c\u9ad8\u7ea7\u590d\u5236\u529f\u80fd\u3002\r\n\r\n\u591a\u6b3eIBM\u4ea7\u54c1\u4e2d\u7684Service Assistant\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ece\u64cd\u4f5c\u7cfb\u7edf\u4e2d\u4e0b\u8f7d\u4efb\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eIBM\u4ea7\u54c1\u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM SAN Volume Controller",
      "IBM Storwize V7000",
      "IBM Storwize V5000",
      "IBM FlashSystem V9000",
      "IBM Storwize V3700",
      "IBM Storwize V3500",
      "IBM FlashSystem 9100 Family",
      "IBM Spectrum Virtualize Software",
      "IBM Spectrum Virtualize for Public Cloud"
    ]
  },
  "referenceLink": "http://www.ibm.com/support/docview.wss\r\nhttps://www.securityfocus.com/bid/107187",
  "serverity": "\u4e2d",
  "submitTime": "2019-02-27",
  "title": "\u591a\u6b3eIBM\u4ea7\u54c1\u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d\u6f0f\u6d1e"
}

CVE-2018-1775 (GCVE-0-2018-1775)

Vulnerability from cvelistv5

Published

2019-02-27 22:00

Modified

2024-09-16 18:43

Severity ?

6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:T/RC:C

CWE

Obtain Information

Summary

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/107187	vdb-entry, x_refsource_BID
	https://exchange.xforce.ibmcloud.com/vulnerabilities/148757	vdb-entry, x_refsource_XF
	https://www.ibm.com/support/docview.wss?uid=ibm10872486	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

IBM

torwize V7000

Version: 7.5
Version: 8.2

IBM	torwize V3500	Version: 7.5 Version: 8.2
IBM	torwize V3700	Version: 7.5 Version: 8.2
IBM	Spectrum Virtualize for Public Cloud	Version: 7.5 Version: 8.2
IBM	Spectrum Virtualize Software	Version: 7.5 Version: 8.2
IBM	SAN Volume Controller	Version: 7.5 Version: 8.2
IBM	FlashSystem V9000	Version: 7.5 Version: 8.2
IBM	torwize V5000	Version: 7.5 Version: 8.2
IBM	FlashSystem 9100 Family	Version: 7.5 Version: 8.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:07:44.355Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "107187",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107187"
          },
          {
            "name": "ibm-storwize-cve20181775-file-download(148757)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148757"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/docview.wss?uid=ibm10872486"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "torwize V7000",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "8.2"
            }
          ]
        },
        {
          "product": "torwize V3500",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "8.2"
            }
          ]
        },
        {
          "product": "torwize V3700",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "8.2"
            }
          ]
        },
        {
          "product": "Spectrum Virtualize for Public Cloud",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "8.2"
            }
          ]
        },
        {
          "product": "Spectrum Virtualize Software",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "8.2"
            }
          ]
        },
        {
          "product": "SAN Volume Controller",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "8.2"
            }
          ]
        },
        {
          "product": "FlashSystem V9000",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "8.2"
            }
          ]
        },
        {
          "product": "torwize V5000",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "8.2"
            }
          ]
        },
        {
          "product": "FlashSystem 9100 Family",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "8.2"
            }
          ]
        }
      ],
      "datePublic": "2019-02-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "TEMPORARY_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/A:N/AC:L/AV:N/C:H/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:T",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Obtain Information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-01T10:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "107187",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107187"
        },
        {
          "name": "ibm-storwize-cve20181775-file-download(148757)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148757"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/docview.wss?uid=ibm10872486"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2019-02-25T00:00:00",
          "ID": "CVE-2018-1775",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "torwize V7000",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.5"
                          },
                          {
                            "version_value": "8.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "torwize V3500",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.5"
                          },
                          {
                            "version_value": "8.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "torwize V3700",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.5"
                          },
                          {
                            "version_value": "8.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Spectrum Virtualize for Public Cloud",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.5"
                          },
                          {
                            "version_value": "8.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Spectrum Virtualize Software",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.5"
                          },
                          {
                            "version_value": "8.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAN Volume Controller",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.5"
                          },
                          {
                            "version_value": "8.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "FlashSystem V9000",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.5"
                          },
                          {
                            "version_value": "8.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "torwize V5000",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.5"
                          },
                          {
                            "version_value": "8.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "FlashSystem 9100 Family",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.5"
                          },
                          {
                            "version_value": "8.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "N",
              "AC": "L",
              "AV": "N",
              "C": "H",
              "I": "N",
              "PR": "L",
              "S": "U",
              "UI": "N"
            },
            "TM": {
              "E": "U",
              "RC": "C",
              "RL": "T"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Obtain Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "107187",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107187"
            },
            {
              "name": "ibm-storwize-cve20181775-file-download(148757)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148757"
            },
            {
              "name": "https://www.ibm.com/support/docview.wss?uid=ibm10872486",
              "refsource": "CONFIRM",
              "url": "https://www.ibm.com/support/docview.wss?uid=ibm10872486"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2018-1775",
    "datePublished": "2019-02-27T22:00:00Z",
    "dateReserved": "2017-12-13T00:00:00",
    "dateUpdated": "2024-09-16T18:43:43.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted